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Abstract. We study the computation of error values in the decoding of codes con- 
structed from order domains. Our approach is based on a sort of analog of the key 
equation for decoding Reed-Solomon and BCH codes. We identify a key equation 
for all codes from order domains which have finitely-generated value semigroups; 
the field of fractions of the order domain may have arbitrary transcendence degree, 
however. We provide a natural interpretation of the construction using the theory of 
Macaulay's inverse systems and duality. O'Sullivan's generalized Berlekamp-Massey- 
Sakata (BMS) decoding algorithm applies to the duals of suitable evaluation codes 
from these order domains. When the BMS algorithm does apply, we will show how 
it can be understood as a process for constructing a collection of solutions of our key 
equation. 



§1. Introduction 

The theory of error control codes constructed using ideas from algebraic geom- 
etry (including the geometric Goppa and related codes) has recently undergone a 
remarkable extension and simplification with the introduction of codes constructed 
from order domains. Interestingly, this development has been largely motivated by 
the structures utilized in the Berlekamp-Massey-Sakata decoding algorithm with 
Feng-Rao-Duursma majority voting for unknown syndromes. 

We will review the definition of an order domain in §2; for now we will simply 
say that the order domains form a class of rings having many of the same prop- 
erties as the rings R = U"_ L(mQ) underlying the one-point geometric Goppa 
codes constructed from curves. The general theory gives a common framework for 
these codes, n-dimensional cyclic codes, as well as many other Goppa-type codes 
constructed from varieties of dimension > 1. H0holdt, Pellikaan, and van Lint have 
given an exposition of order domains in [HPL], synthesizing work of many others 
in the coding theory community, and this is probably the best general reference for 
this topic. 
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More recently, Geil and Pellikaan ([GP],[Gei]) and O'Sullivan ([OS1]) have stud- 
ied the structure of order domains whose fields of fractions have arbitrary transcen- 
dence degree. Moreover, O'Sullivan ([OS2]) has shown that the Berlekamp-Massey- 
Sakata decoding algorithm (abbreviated as the BMS algorithm in the following) and 
the Feng- Rao procedure extend in a natural way to a suitable class of codes in this 
much more general setting. 

The decoding problem here can be divided into two parts: determination of 
the error locations, then determination of the corresponding error values. When 
it applies, the BMS algorithm produces a Grobner basis for what is known in the 
usual terminology as the error- locator ideal corresponding to the error vector, hence 
sufficient information to determine the error locations. Here, we will consider the 
problem of determining the error values in conjunction with the BMS algorithm or 
some other algorithm that determines the error locator ideal. 

For the Reed-Solomon codes (the simplest examples of codes from order do- 
mains, or geometric Goppa codes), the Berlekamp-Massey decoding algorithm (the 
precursor of BMS) can be phrased as a method for solving a key equation. For a 
Reed-Solomon code with minimum distance d = 2t + 1, the key equation has the 
form 

(1.1) fS = g mod (X 2t ). 

Here £ is a known univariate polynomial in X constructed from the error syn- 
dromes, and /, g are unknown polynomials in X. If the error vector e satisfies 
wt(e) < t, there is a unique solution (/, g) with deg(/) < t, and deg(g) < deg(f) 
(up to a constant multiple) . The polynomial / is known as the error locator because 
its roots give the inverses of the error locations; the polynomial g is known as the 
error evaluator because the error values can be determined from values of g at the 
roots of /, via the Forney formula. 

O'Sullivan has introduced a generalization of this key equation for one-point 
geometric Goppa codes from curves in [OS3] and shown that the BMS algorithm 
can be modified to compute the analogs of the error-evaluator polynomial together 
with error locators. His definitions make heavy use of the particular features of the 
curve case, however. For instance the objects corresponding to S and g in (1.1) are 
differentials on the underlying curve. 

Our main goals in this article are the following. First, we wish to identify an 
analog of the key equation (1.1) for codes from order domains. We will only consider 
order domains whose value semigroups are finitely generated. In these cases, the 
ring R can be presented as an affine algebra R = ¥[Xi, . . . ,X S ]/I, where the 
ideal / has a Grobner basis of a very particular form (see [GP] and §2 below). 
Although O'Sullivan has shown how more general order domains arise naturally 
from valuations on function fields, it is not clear to us how our approach applies 
to those examples. On the positive side, by basing all constructions on algebra in 
polynomial rings, all codes from these order domains can be treated in a uniform 
way, Second, we also propose to study the relation between the BMS algorithm 
and the process of solving this key equation in the cases where BMS is applicable. 
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Finally, we wish to show how solutions of our key equation can be used to determine 
error values and complete the decoding process. 

Our key equation generalizes the key equation for n-dimensional cyclic codes 
studied by Chabanne and Norton in [CN]. Results on the algebraic background 
for their construction appear in [Nortonl]. See also [Norton2] for connections with 
the more general problem of finding shortest linear recurrences, and [NS] for a 
generalization giving a key equation for codes over commutative rings. In the 
present article, we will point out another natural interpretation of these ideas in 
the context of Macaulay's inverse systems for ideals in a polynomial ring (see [Mo], 
[EI]) and the theory of duality. 

In spirit, our approach is also quite close to the treatment of one-point geometric 
Goppa codes from curves by Heegard and Saints in [HS] , in that we essentially treat 
all of our codes as (subcodes of) punctured n-dimensional cyclic codes. 

The present article is organized as follows. In §2 we will briefly review the 
definition of an order domain, evaluation codes and dual evaluation codes. We will 
also introduce some standard examples. §3 contains a quick summary of the basics 
of Macaulay inverse systems and duality for quotients of a polynomial ring by zero- 
dimensional ideals. In §4 we introduce the key equation. We will also relate the 
BMS algorithm to the process of solving this equation. §5 is devoted to a discussion 
of how the key equation can be used to determine error values. The major idea 
appears already for the case of n-dimensional cyclic codes in [CN]. However, our 
results apply more generally and include a few improvements. Finally, in §6 we 
present two detailed decoding examples using these methods. 

The author wishes to thank Mike O' Sullivan for comments on an earlier draft of 
this paper. 

§2. Codes from Order Domains 

In this section we will briefly recall the definition of order domains and explain 
how they can be used to construct error control codes. We will use the following 
formulation. 

(2.1) Definition. Let R be a F g -algebra and let (T, +, >-) be a well-ordered semi- 
group. An order function on R is a surjective mapping p : R — > {— oojUT satisfying: 

(1) p(f) = -oo & f = 0, 

(2) p(cf) = p(f) for all / G R, all c ^ in F„ 

(3) p(f + g)±m^{p(f),p(g)}, 

(4) if p(f) = p(g) 7^ — oo, then there exists c ^ in ¥ q such that p(f) -< 
p(f ~ c 9), 

(5) P(fg) = p(f) + P (g). 

We call r the value semigroup of p. 

The terminology "order function" is supposed to suggest the existence of ¥ q - 
bases of R whose elements have distinct p-values, and are hence ordered by p. This 
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is a consequence of Axiom 4. It is also possible to reindex the corresponding bases 
by the natural numbers and define order functions in a different but equivalent way. 
This is done, for instance, in [OS1] and [OS2]. 

Axioms 1 and 5 in this definition imply that R must be an integral domain. In 
the cases where the transcendence degree of R over ¥ q is at least 2, a ring R with 
one order function will have many others too. For this reason an order domain is 
formally defined as a pair (R, p) where R is an F 9 -algebra and p is an order function 
on R. However, from now on, we will only use one particular order function on R 
at any one time. Hence we will often omit it in refering to the order domain, and 
we will refer to V as the value semigroup of R. 

From one point of view, order functions come from valuations on K = QF(R). 
As noted by O'Sullivan in [OS1], in fact S = {f/g : p(g) h p(f)} is a valuation 
ring of K. From now on, we will restrict our attention to the case that T is a 
sub-semigroup of Z> , for some r > 1, hence is finitely generated. Without loss of 
generality, then, we may assume r = tr.deg.^ (K). To obtain a well-ordering on 
Z> we can fix a monomial order, y. 

As noted in the introduction, order domains give a common generalization of 
several types of rings that have been used in the construction of codes. For instance, 
the order domains used in the construction of one-point geometric Goppa codes are 
the following. If Y is a smooth projective curve defined over ¥ q , and Q is an ¥ q - 
rational point on Y, then R = U^ =0 L(mQ) is an order domain. T is equal to the 
Weierstrass semigroup of Y at Q (the sub-semigroup of Z> consisting of all pole 
orders of rational functions on X with poles only at Q), and p(f) = — vq(/), where 
vq is the discrete valuation at Q on the function field of Y. The polynomial ring 
R = W q [X\, . . . , X r ] is an order domain, where V = Z> , y is a monomial order, and 
p(f) for / 7^ is defined by p(f) = a if LT y (f) = X a . These examples of order 
domains feature in the construction of Reed-Muller and other multidimensional 
cyclic codes. Many other classes of examples are considered in [Gei] and [GP]. 

Geil and Pellikaan (see [GP]) have proved a characterization of order domains 
with finitely generated T, which we will now review. In the following statement, M 
is an r x s matrix with entries in Z>q with linearly independent rows. For a G Z> 
(written as a column vector), the matrix product Ma is a vector in Z> . We will 
call this the M-weight of the monomial. We write (M) for the subsemigroup of 
Z> generated by the columns of M, ordered by any convenient monomial order y 
on Z> (for instance the lex order as in Robbiano's characterization of monomial 
orders by weight matrices). We will make use of the monomial orders >m,t on 
¥ q [X u . . . , X s ] defined as follows: X a > M , T ^ if Ma y MP, or if Ma = M/3 and 
X a > T X 13 , where r is another monomial order used to break ties. 

(2.2) Theorem. (Geil- Pellikaan) 

(1) Let T = (M) C Z> be a semigroup. Let I C ¥ q [Xi, . . . ,X S ] be an ideal, 
and let G be the reduced Grobner basis for I with respect to a weight order 
> = >m,t cis above. Suppose that every element ofG has exactly two mono- 
mials of highest M -weight in its support, and that the monomials in the com- 
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plement o/LT>(7) (the "standard monomials" or monomials in the "foot- 
print of the ideal") have distinct M -weights. Then R = ¥ q [Xi, . . . ,X S ]/I 
is an order domain with value semigroup V and order function p defined as 
follows: Writing f in R as a linear combination of the monomials in the 
complement of LT > {I), p(f) = max^ {M(3 : X? e supp(f)}. 
(2) Every order domain with semigroup V = (M) has a presentation R = 
¥ q [Xi, . . . ,X 8 ]/I such that the reduced Grobner basis of I with respect to 
>m,t and the standard monomials have the form described in part (1). 

In principle, this result gives a method to construct the order domains with a 
given value semigroup T, as in following example. 

(2.3) Example. Take r = 2, V = (M) C Z> , ordered by y the lexicographic 
order, where 



By the definition, the order function p must be surjective, so there exist x,y,z G R 
with p(x) = (0,2), p(y) = (1,1), p(z) = (3,0), R is generated by x,y,z, and 
p(x a y b z c ) is equal to the M-weight M(a, 6, c)* for all monomials x a y b z c . It follows 
that there is a surjective ring homomorphism 



where <j)(X) = x, <f>(Y) = y, and <f>(Z) = z. We consider the monomial order 
>M,iex on ¥ q [X,Y,Z}. It is easy to see that all Z-relations between p(x), p(y), 
p(z) are generated by Sp(x) + 2p(z) = Qp(y)- For Definition (2.1) to hold, we must 
have p(x 2 z 3 — cy 6 ) < p(x 2 z 3 ) for some c ^ 0. Hence R = ¥ q [X,Y, Z]/I, where 
I = {F} for some F = X 2 Z 3 — cY 6 + H(X, Y, Z), where every term in H is less 
than Y 6 in the >M,iex order. The monomials in the complement of (X 2 Z 3 ) have 
distinct M-weights and G = {F} is a Grobner basis for I of the required form, so 
all such R are order domains by Theorem (2.2). Note that all are deformations of 
the monomial algebra ¥ q [u 2 , uv, v ]. Indeed, Theorem (2.2) can be reinterpreted 
as saying that the order domains with semigroup V are all flat deformations of the 
monomial algebra F g [r]. This point of view is exploited in [L] to construct order 
domains in the function fields of varieties such as Grassmannians and flag varieties. 

The most direct way to construct codes from an order domain given by a par- 
ticular presentation R = ¥ q [Xi, . . . , X s ]/I is to generalize Goppa's construction in 
the case of curves: 

(2.4) Construction of Codes. 

(1) Let X R be the variety V(I) C A s and let 




<l>:¥ q [X,Y,Z]^R, 



X R (¥ q ) = {P 1 



7 • • • 7 Pfl\ 



be the set of F 5 -rational points on X R . 
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(2) Define an evaluation mapping 

ev : R -> F£ 

f^(f(P 1 ),...,f(P n )) 

(3) Let V C R be any finite-dimensional vector subspace. Then the image 
ev(V) C F™ will be a linear code in F™. One can also consider the dual code 

(4) Of particular interest here are the codes constructed as follows. Let A 
be the ordered basis of R given by the monomials in the complement of 
LT>(I). Note that this basis comes equiped with an ordering by p- value, 
or equivalently by the M- weights ordered by >- in Z> . Let i G N and let 
Vi be the span of the first £ elements of the ordered basis A. In this way, 
we obtain evaluation codes Evg = ev(Vg) and dual codes Ci = Evj- for all 
L 

The BMS algorithm is specifically tailored for this last class of codes. If the Cg 
codes are used to encode messages, then the Ev£ codes describe the parity checks 
and the syndromes used in the decoding algorithm. 

§3. Preliminaries on Inverse Systems 

A natural setting for our formulation of a key equation for codes from order 
domains is the theory of inverse systems of polynomial ideals originally introduced 
by Macaulay ([Ma]). There are several different versions of this theory. For modern 
versions using the language of differentiation operators, see [Mo] or [EI]. Here, we 
will summarize a number of more or less well-known results, using an alternate 
formulation of the definitions that works in any characteristic. A reference for this 
approach is [North]. 

Let k be a field, let S = k[Xi, . . . , X s ] and let T be the formal power series ring 
fc[[Xj~ , . . . , A7 1 ]] m the inverse variables. T is an S'-module under a mapping 

c: SxT 

(f,g) *-> f-9, 

sometimes called contraction, defined as follows. First, given monomials X a in S 
and X'f 3 in T, X a ■ X~P is defined to be X a ~^ if this is in T, and otherwise. We 
then extend by linearity to define c : S x T — > T. 

Let Hom,k(S, k) be the usual linear dual vector space. It is a standard fact that 
the mapping 

</> : Hom k (S, k)^T 

Ah ^ ^X^X-P 

pezy 
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is an isomorphism of S-modules, if we make Horrik(S, k) into an S'-module in the 
usual way by defining (qA)(p) = A(qp) for all polynomials p, q in S. In explicit 
terms, the /c-linear form on S obtained from an element of g G T is mapping A g 
defined as follows. For all / G S, 

A g (f) = (f.g) , 

where (t)o denotes the constant term in t G T. In the following we will identify 
elements of T with their corresponding linear forms on S. 

For each ideal I C i?, we can define the annihilator, or inverse system, of I in T 

as 

/ 1 = {AgT:A(p) = 0, VpGl}. 

It is easy to check that I 1 - is an S-submodule of T under the module structure 
defined above. Similarly, given an S'-submodule H C T, we can define 

H ± = {peS: A(p) = 0, V A G H}, 

and H 1 - is an ideal in R. 

The key point in this theory is the following duality statement. 

(3.1) Theorem. The ideals of R and the S-submodules of T are in inclusion- 
reversing bijective correspondence via the constructions above, and for all /, H we 
have: 

(1^ = 1, (H ± ) ± = H. 

See [North] for a proof. 

We will be interested in applying Theorem (3.1) when / is the ideal of some 
finite set of points in the n-dimensional affine space over k (e.g. when k = ¥ q and 
/ is an error-locator ideal arising in decoding - see §4 below). 

(3.2) Lemma. Let 

I = mp 1 fl • • • fl mp t , 

where mp i is the maximal ideal of S corresponding to the point Pi, and t > 1. The 
submodule of T corresponding to I has the form 

H = I ± = (m Pl ) ± © • • • © (mpj^. 

Proof. In Proposition 2.6 of [Ger], Geramita shows that (/ fl J) 1 - = I 1 - + J 1 - for 
any pair of ideals. The idea is that I 1 - and J 1 - can be constructed degree by degree, 
so the corresponding statement from the linear algebra of finite-dimensional vector 
spaces applies. The equality (I + J) 1 - = J -1 - fl J 1 - also holds from linear algebra 
(and no finite-dimensionality is needed). The sum in the statement of the Lemma 
is a direct sum since mp i + \^j^imp j = S, hence (mpj- 1 fl Ej^^mp^)- 1 - = {0}. □ 

We can also give a concrete description of the elements of (mp) 1 . 
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(3.3) Proposition. Let P = (a\, . . . , a s ) E A s over k, and let Li be the coordinate 
hyperplane Xi = aj containing P. 

(1) (mp) ± is the cyclic S-submodule of T generated by 

where if u = (ui, . . . , u s ), P u denotes the product a" 1 • • • a™ 3 (X u evaluated 
at P). 

(2) / • hp = f(P)hp for all f E S, and the submodule (trip) 1 - is a one- 
dimensional vector space over k. 

(3) Let be the ideal (Xi — a^) in S (the ideal of Li). Then (I Li) is the 
submodule of T generated by 

oo 
3=0 

(4) In T , we have 

s 

i=i 



Proof. (1) First, if / e mp, and g E S is arbitrary then 

KhAf) = (f-(9- h P ))o = ((fg) ■ h P ) = f(P)g(P) = 0. 

Hence the S-sub module (hp) is contained in (mp)- 1 . Conversely, if h E (mp) ± , 
then for all / E mp, 

= A h (f) = (f ■ h) . 

An easy calculation using all / of the form / = — a@ E mp shows that h = chp 
for some constant c. Hence (mp) 1 - = (hp). 

(2) The second claim follows by a direct computation of the contraction product 
/ • h p . 

(3) Let / E I Li (so / vanishes at all points of the hyperplane Li), and let g E S 
be arbitrary. Then 

Kh Li (f) = (f ■ (g ■ h Li ))o 
= ((fg)-h Li ) 

= f(0,...,0,a i ,Q,...,0)g(0,...,0,a i ,0,...,0) 
= 0, 
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since the only nonzero terms in the product ((fg) ■ h^) come from monomials in 
fg containing only the variable Xj. Hence (/iz,;) C T is contained in ij;.. Then we 
show the other inclusion as in the proof of (1). 

(4) We have mp = I Ll H {-I Ls . Hence (mp) 1 - = (Il 1 ) ± H • • • n (I L J" 1 , and the 

claim follows. We note that a more explicit form of this equation can be derived 
by the formal geometric series summation formula: 



Finally, we note that both the polynomial ring S and the formal power series 
ring T can be viewed as subrings of the field of formal Laurent series in the inverse 
variables, 

K = k((X^ 1 ,...,X- 1 )), 

which is the field of fractions of T. Hence there is a natural interpretation of the 
(full) product fg for / G S and g G T as an element of K. The contraction product 
/ ■ g can be understood as a projection of fg into T C K (image under the linear 
projection with kernel spanned by all monomials not in T). In the sequel, we will 
also need to make use of the projection of fg into S + = (A l7 . . . , X s ) C S C K 
under the linear projection with kernel spanned by all monomials not in S+. We 
will denote this by (fg) + . Hence (fg)+ gives the sum of all terms in fg with all 
exponents nonnegative and some exponent strictly positive, while / ■ g gives the 
sum of all terms in fg with nonpositive exponents. Any "mixed terms" in fg (i.e. 
those terms with some positive and some negative exponents) will be irrelevant in 
our applications. We will use the following fact. 

(3.4) Proposition. Let f G k[Xi] be a univariate polynomial satisfying f(P) = 0. 
Then 

(fhp)+ = X t g, 
where g(P) = f'(P) (formal derivative) . 
Proof. This follows by a direct computation using (3.3). □ 

§4. The Key Equation and its Relation to the BMS Algorithm 

In this section, we will introduce our key equation for codes from order do- 
mains and relate it to the Berlekamp-Massey-Sakata decoding algorithm. Let C 
be one of the codes C = ev{V) or eviV) 1 - constructed from an order domain 
R = W q [Xi,... ,X S ]/I as in §2 above. Consider an error vector e G (where 
entries are indexed by the elements of the set Xp(¥ q )). In the usual terminology, 
the error-locator ideal corresponding to e is the ideal I e C ¥ q [Xi, . . . , X s ] defining 
the set of error locations: 



I e = {fE ¥ q [X u ...,X S }: f(P) = 0, V P s.t. e P ^ 0}. 
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(Since I e D I, one could also consider the ideal corresponding to I e in R. However, 
following the general philosophy of Heegard and Saints in [HS] , we will find it more 
convenient to work with I e as an ideal in the polynomial ring.) 

We will also use a slightly different notation and terminology in the following 
because we want to make a systematic use of the observation that this ideal depends 
only on the support of e, not on the error values. Indeed, many different error 
vectors yield the same ideal defining the error locations. For this reason we will 
introduce £ = {P : ep ^ 0}, and refer to the error-locator ideal for any e with 
supp(e) = £ as Ig. 

For each monomial X u e . . . , X s ], we let 

(4.1) E u = (e,ev(X u ))= £ e P P u 

Pex R (¥ q ) 

be the corresponding syndrome of the error vector. (As in (3.3), P u is shorthand 
notation for the evaluation of the monomial X u at P.) 

In the practical decoding situation, of course, for a code C = ev^V) 1 - where V 
is a subspace of R spanned by some set of monomials, only the E u for the X u in a 
basis of V are initially known from the received word. 

In addition, the elements of the ideal I + (Xf — Xi, . . . , X% — X s ) defining the 
set Xn(¥ q ) give relations between the E u . Indeed, the E u for u in the ordered basis 
A for R with all components < q — 1 determine all the others, and these syndromes 
still satisfy additional relations. Thus the E u are, in a sense, highly redundant. 

To package the syndromes into a single algebraic object, we define the syndrome 
series 

S e = E U X~ U 



>o 



in the formal power series ring T = F^AY 1 , . . . , X- 1 ]]. (This depends both on the 
set of error locations £ and on the error values.) Chabanne and Norton considered 
the same type of expression in [CN] for n-dimensional cyclic codes. As in §3, we 
have a natural interpretation for S e as an element of the dual space of the ring 
S = ¥ q [X u ... ,X S }. 

A fundamental tool in our considerations will be the following expression for the 
syndrome series «S e . We substitute from (4.1) for the syndrome E u and change the 
order of summation to obtain: 

S e = ^ E U X 

(4.2) 



Pex R (¥ q ) ueii a 
Pex R (¥ q ) 
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where hp is the generator of (mp) 1 - from (3.3). The sum in (4.2), taking the terms 
with ep 7^ 0, gives the decomposition of S e in the direct sum expression for 1^ as 
in (3.2). 

The following result is well-known in a sense; it is a translation of the standard 
fact that error-locators give linear recurrences on the syndromes. But to our knowl- 
edge, this connection has not been considered from exactly our point of view in this 
generality (see [AD] for a special case). 

(4.3) Theorem. With all notation as above, 

(1) f E Is if and only if f • S e = for all error vectors e with supp(e) = £ . 

(2) For eache with supp(e) = £, Is = (<S e )~ L in the duality from Theorem (3.1). 

(3) If e,e' are two error vectors with the same support, then (S e ) = (S e /) as 
submodules ofT. 



Proof. For (1), we start from the expression for S e from (4.2). Then by (3.3), we 
have 

f-S e =J2 e P (f -h P ) = J2 e P f(P)hp. 
pes Pee 

If / E Is, then clearly / • S e = for all choices of error values ep. Conversely, if 
/ • S e = for all e with supp(e) = £, then f(P) = for all P E £, so / G I £ - 
Claim (2) follows from (1). 

The perhaps surprising claim (3) is a consequence of (2). Another way to prove 
(3) is to note that there exist g E R such that g(P)ep = e' P for all P E £. We have 

g-S e = ^2 e p(9 ■ hp) = ^ e P g(P)h P = e' P h P = S e >. 
Pes Pes Pes 

Hence («S e /) C (S e ). Reversing the roles of e and e', we get the other inclusion as 
well, and (3) follows. □ 

The following explicit expression for the terms in / • <S e is also useful. Let 
f = E m fmX m ES. Then 

f-S e = (J2 fmX m ) ■ ( E - X ' U ) 

(4.4) 



— ^2 C^2fmEm+r)X T . 



re1 3 >0 m 



Hence / • S e = <^> J2 m fmEm+r = for all r > 0. 

The equation / • S = from (1) in (4.3) is the prototype, so to speak, for 
our generalizations of the key equation to all codes from order domains, and we 
will refer to it as the key equation in the following. It also naturally generalizes 
all the various key equations that have been developed in special cases, as we will 
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demonstrate shortly. Before proceeding with that, however, we wish to make several 
comments about the form of this equation. 

Comparing the equation f-S e — with the familiar form (1.1), several differences 
may be apparent. First, note that the syndrome series S e will not be entirely known 
from the received word in the decoding situation. The same is true in the Reed- 
Solomon case, of course. The polynomial S in the congruence in (1.1) involves only 
the known syndromes, and (1.1) is derived by accounting for the other terms in the 
full syndrome series. With a truncation of S e in our situation we would obtain a 
similar type of congruence (see the discussion following (4.14) below, for instance). 

It is apparently rare, however, that the portion of S e known from the received 
word suffices for decoding up to half the minimum distance of the code. As first 
noted for the one-point geometric Goppa codes from curves, it is often the case 
that additional syndromes (or other extra information about the error) must be 
determined in order to exploit the code's full error correcting capacity. For this 
reason, even though we have not made any hypotheses so far on how our code was 
constructed (i.e. on how the vector subspace V C R was chosen), the key equation 
will be most useful in the case that C is one of the codes Cg = Evf defined in §2, 
for which the Feng-Rao majority voting process for unknown syndromes and the 
generalized BMS algorithm are applicable. 

Another difference is that there is no apparent analog of the error-evaluator 
polynomial g from (1.1) in the equation in / • S e = 0. In §5, we will see that the 
way to obtain error evaluators in this situation is to consider the "purely positive 
parts" (fS e )+ for certain solutions of our key equation. 

We now turn to several examples that show how our key equation relates to 
several special cases that have appeared in the literature. 

(4.5) Example. We begin by providing more detail on the precise relation between 
(4.3), part (1) in the case of a Reed-Solomon code and the usual key equation from 
(1.1). These codes are constructed from the order domain R = ¥ q [X] (where 
T = Z> and p is the degree mapping), according to (4.4). The key equation (1.1) 
applies to the code Evg = ev(Vg), where Vg = Span{l, X, X 2 , . . . , A^ -1 }, and the 
evaluation takes place at all F 9 -rational points on the affine line, omitting 0. 

For the Evg Reed-Solomon codes, the known syndromes are Ei, . . . , E^-i, and 
S is the syndrome polynomial: 

S = E 1 + E 2 X + ■■■ + E d _ x X d - 2 . 

In the special solution (/,#) of (1.1) used for decoding, 

i=l 

where a~ ei are the error locations. Moreover, 

\£\ 

g = J2^a l Y[(l-a^x). 

i=l j^i 
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If (1.1) is written as an equation 

fS = g + x 2 % 

then h is another polynomial of degree \£\ — 1 sometimes called the error coevaluator: 

\£\ 

i=l j^i 

Either g or h can be used to solve for the error values once the roots of / are 
determined. 

Our key equation in this case is closely related, but not precisely the same. The 
natural way to apply (4.3) here is to the dual code Cn = Evj^. Our prototype 
key equation / • S e = uses the full syndrome series, but of course, we could also 
consider the truncation of S e using only the known syndromes Eq, . . . , Eg-i and 
obtain a congruence close in form to (1.1). 

Starting from (4.4) and using the formal geometric series summation formula as 
in (3.3) part (4), we can write: 

S e =^2 e P h P 
Pe£ 

Pe£ u>o 

1 



= E 



ep- 



1-P/X 

Pes 1 



X 



Ep 6 g e P HQe£,Q?p( x ~ Q) 

Ylpesix-P) 



Hence, in this formulation, S e = Xq/p, where p is the generator of the (actual) 
error locator ideal. By considering the truncated form of / • <S e = 0, it can be 
seen that our q is actually the analog of the error coevaluator as above. Moreover 
if / = p, then (pS e ) + = Xq gives the error (co)evaluator. There are no "mixed 
terms" in the products fS e in this one-variable situation. 

(4.6) Example. The key equation for s-dimensional cyclic codes introduced by 
Chabanne and Norton in [CN] has the form: 

(4.7) aS e =lf[X t 

\i=i 

where 

s 

i=i 
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and o"j is the univariate generator of the elimination ideal Is fl ¥ q [Xj\ . Our version 
of the Reed-Solomon key equation from (4.5) is a special case of (4.7). Moreover, 
(4.7) is clearly the special case of (4.3), part (1) for these codes where / = a is 
the particular error locator polynomial rii=i a 'i(^) ^ For this special choice 
of error locator, a ■ S e = 0, and (aS e ) + = (Yli=i Xj) g for some polynomial g. This 
last claim can be established using (4.4). We see that S e can be written as 

and the product aS e = (aS e ) + reduces to a polynomial (again, there are no "mixed 
terms" ) . 

In order to use (4.7) for decoding, Chabanne and Norton propose iterated appli- 
cations of the one-variable Berlekamp-Massey algorithm to find the factors of the 
product a one at a time. In §5 and §6 we will see that the more general BMS al- 
gorithm gives additional flexibility for decoding these codes, although the equation 

(4.7) will still lead most directly to determination of the error values. 

(4.8) Example. We now turn to the key equation for one-point geometric Goppa 
codes introduced by O'Sullivan in [OS3]. Let X be a smooth curve over ¥ q of genus 
g, and consider one-point codes constructed from R = W^ =Q L(mQ) for some point 
Q E X(W q ), O' Sullivan's key equation has the form: 

(4.9) fu e = 0. 

Here u e is the syndrome differential, which can be expressed as 

= ^2 e P u P} Q, 

P€X(W q ) 

where lop,q is the differential of the third kind on Y with simple poles at P and Q, 
no other poles, and residues 

resp(ujp jQ ) = 1, res Q {u PiQ ) = -1. 

For any / e R, we have 

res Q (fuj e ) = J^e P /(P), 
p 

the syndrome of e corresponding to /. (We only defined syndromes for monomials 
above; taking a presentation R = ¥ q [Xi, . . . ,X S ]/I, however, any / e R can be 
expressed as a linear combination of monomials and the syndrome of / is defined 
accordingly.) The right-hand side of (4.9) is also a differential. In this situation, 
(4.9) furnishes a key equation in the following sense: / is an error locator (i.e. 
/ is in the ideal of R corresponding to Is) if and only if </> has poles only at Q. 
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In the special case that (2g — 2)Q is a canonical divisor (the divisor of zeroes of 
some differential of the first kind uq on X), (4.9) can be replaced by the equivalent 
equation 

(4.10) fo e = g, 

where o e = (v e /ujQ and g = 4>/uq are rational functions on X. Since ujq is zero 
only at Q, the key equation is now that / is an error locator if and only if (4.9) is 
satisfied for some g e R. 

For instance, when X is a smooth plane curve V(F) over ¥ q defined by F G 
¥ q [X, Y], with a single point Q at infinity, then it is true that (2g — 2)Q is canonical. 
O'Sullivan shows in Example 4.2 of [OS3] (using a slightly different notation) that 

(4.11) o e = epHp i 

Pex{¥ q ) 

where if P = (a, 6), then Hp = (x-i)(y-_b) • This is a function with a pole of order 
1 at P, a pole of order 2g — 1 at Q, and no other poles. 

To relate this to our approach, note that we may assume from the start that 
Q = (0 : 1 : 0) and that F is taken in the form from Theorem (2.2), that is 

F(X, Y) = X 13 - cY a + G(X, Y) 

for some relatively prime a < (3 generating the value semigroup at Q. Every term 
in G has (a, f3) -weight less than a/3. 

Then we can proceed as in Example (4.3) of [OS3] to relate Hp to an element 
oiT = W q [[X~ 1 ,Y~ 1 ]]. First we rearrange to obtain 

F(a,Y) 
P (X-a)(Y-b) 
_ a 13 - cY a + Gja, Y) 

(X-a)(Y-b) 
= (of - XP) + F(X, Y) + (G(a, Y) - G(X, Y)) 
(X-a)(Y-b) 

The F(X, Y) term in the numerator does not depend on P. We can collect those 
terms in the sum (4.11) and factor out the F(X, Y). We will see shortly that those 
terms can in fact be ignored. The G(a, Y) — G(X, Y) in the numerator furnish 
terms that go into the error evaluator g here. The remaining portion is 

(X-a)(X-b) = Y 2L,2^X*Y>- 
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The sum here looks very much like that defining our hp from (3.3), except that 
it only extends over the monomials in complement of (LT(F)). Call this last sum 
hp. As noted before the full series hp (and consequently S) are redundant. For 
example, every ideal contained in mp (for instance the ideal I = (F) defining the 
curve), produces relations between the coefficients. From the duality theorem (3.1), 
we have that I C mp implies (mp) 1 - C i" -1 , so F • hp = 0. 

The relation F ■ hp = says in particular that the terms in h' P are sufficient to 
determine the whole series hp. Indeed, we have 



It follows that O'Sullivan's key equation and ours are equivalent. 

We now turn to the precise relation between solutions of our key equation and the 
polynomials generated by steps of the BMS decoding algorithm applied to the Cg = 
Evj- codes from order domains R. We will see that the steps of the BMS algorithm 
systematically produce successively better approximations to solutions of f -S e = 0, 
so that in effect, the BMS algorithm is a method for solving the key equation for 
these codes. In addition to [OS3] cited previously, a similar interpretation of the 
Berlekamp-Massey algorithm in the Reed-Solomon case (and related cases) was 
developed by Fitzpatrick in [F] (see also [CLO], Chapter 9, §4). 

We recall the key features of O'Sullivan's presentation of BMS. For our purposes, 
it will suffice to consider the "Basic Algorithm" from §3 of [OS2], in which all needed 
syndromes are assumed known and no sharp stopping criteria are identified. The 
syndrome mapping corresponding to the error vector e is 



where as above S is the set of error locations. The same reasoning used in the proof 
of our Theorem (4.2) shows 



From Definition (2.1) and Geil and Pellikaan's presentation theorem (2.2), we 
have an ordered monomial basis of R: 




Syn e : R^W q 



/->£ ep /(P), 



Pes 



(4.12) 



feh &Syn e (fg) = 0,VgeR. 



A = {x a ^ j e N}, 
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whose elements have distinct p-values. As in the construction of the Evg codes, we 
write Vi = Span{l = X a ^\ . . . , X a ^}. The V e exhaust R, so for / ^ G R, we 
may define 

o(f) = mm{£ : / G V e }, 

and (for instance) o(0) = —1. Indeed, all properties of order domains can be 
restated in terms of o, and O'Sullivan uses this function rather than p in [OS1] 
and [OS2]. In particular the semigroup V in our presentation carries over to a 
(nonstandard) semigroup structure on N defined by the addition operation 

i © j = k & o(x°wrW) = k. 

Given / G R, one defines 

span(f) = min{£ : 3g e V £ s.t. Syn e (fg) ^ 0} 
fail(f) =o(f)®span(f). 

When / G Is, span(f) = fail(f) = oo. 

The BMS algorithm, then, is an iterative process which produces a Grobner 
basis for Ig with respect to the monomial order > = >m,t i n (2-2). The strategy 
is to maintain data structures for all m > 1 as follows. The A m are an increasing 
sequence of sets of monomials, converging to the monomial basis for Ig as m — > oo. 
5 m is the set of maximal elements of A m with respect to > (the "interior corners of 
the footprint"). Similarly, we consider E m = Z> \ A m , and a m , the set of minimal 
elements of E m (the "exterior corners"). For sufficiently large m, the elements of 
cr m will be the leading terms of the elements of the Grobner basis of If, and E m 
will the be set of monomials in LT > (/ £ ;). 

For each m, the algorithm also produces collections of polynomials F m = {f m (s) : 
s G cr m } and G m = {g m {c) : c e 5 m } satisfying: 

o(f m (s)) = s, fail(f m (s)) > m 

and 

span(g m (c)) = c, fail(g m (c)) < m. 

In the limit asm-> oo, by (4.12), the F m yield the Grobner basis for Ig. 
We record the following simple observation. 

(4.13) Proposition. With all notation as above, suppose f G R satisfies o(f) = s, 
fail(f) > m. Then 

f ■ S e = mod W Sj7n , 

where W s>rn is the ¥ q -vector subspace of the formal power series ring T spanned by 
the X~ a ^ such that s © j 

Proof. By the definition, fail(f) > m means that Syn e (fX a ^) = for all k with 
o(f) ®k <m. By the definitions of S e and the contraction product, Syn e (f X a ^) 
is exactly the coefficient of X~ a ^ in / ■ <S e . □ 



18 



A KEY EQUATION FOR CODES FROM ORDER DOMAINS 



The subspace W Sjm in (4.13) depends on s = o(f). In our situation, though, 
note that if s' = max{o(/) : / G F m } : then (4.13) implies 



for all / = fm(s) in F m . Moreover, only finitely many terms from S e enter into any 
one of these congruences, so (4.14) is, in effect, a sort of general analog of (1.1). 

The fm(s) from F m can be understood as approximate solutions of key equation 
(where the goodness of the approximation is determined by the subspaces W s > im , 
a decreasing chain, tending to {0} in T, as m — > oo). The BMS algorithm thus 
systematically constructs better and better approximations to solutions of the key 
equation. O'Sullivan's stopping criteria ([OS2]) show when further steps of the 
algorithm make no changes. Also note that the Feng-Rao theorem shows that any 
additional syndromes needed for this can be determined by the majority-voting 
process when wt(e) < — lj_ 

We conclude this section by noting that O'Sullivan has also shown in [OS3] that, 
for codes from curves, the BMS algorithm can be slightly modified to compute error 
locators and error evaluators simultaneously in the situation studied in Example 
(4.7). The same is almost certainly true in our general setting, although we have 
not worked out all the details. One reason we have not done so is that it is not 
clear that all of the purely positive parts (fS e ) + for / G Is are directly useful 
for determining error values. That seems to be true only for special / G Is (in 
particular, for the univariate polynomials in the elimination ideals Is fl F^LY^]). 
In the practical decoding situation, once the BMS algorithm is executed, the next 
step would be to solve a system of polynomial equations to determine the error 
locations, i.e. to find the variety V(Ig) using the computed Grobner basis for Is- 
Many of the same techniques useful for that process can efficiently produce the 
needed univariate polynomials as a byproduct. Hence we will not consider the sort 
of modification of BMS proposed in [OS3]. 



In this section, we will see how solutions / of the key equation (4.3), part (1) 
can be used to determine error values. The method is the same as that presented 
in [CN]; our proofs are significantly simplified by the use of the formalism from §3. 

We will begin with some general results concerning the polynomials (fS) + for 
univariate f £ Is- First we consider a simple special case. Let S = {Pi, ■ ■ ■ ,Pt} = 
supp(e) for the error vector e. We will say that S is in general position with respect 
to Xi if the AVcoordinates of the Pj are distinct. 

(5.1) Proposition. Let e be an error vector such that S is in general position with 
respect to Xi. Let f be the monic generator of the elimination ideal Is H F g [Xj], 
then (fS e ) + = Xig for some g G F g pQ]. Moreover, if P is any one of the points 
in £ , the error value ep may be recovered by computing 



(4.14) 



f-S e = mod W a > t 



§5. Determination of Error Values 



e P = 



g(P) 



f(py 
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where f is the formal derivative. 



Note that this is exactly the way error values are usually determined in Reed- 
Solomon decoding. The formal derivative does not vanish at P because the roots 
of / are distinct. 

Proof. We use the formula (4.4) for <S e and (3.3), retaining only terms with ep ^ 0: 



s * = E \ ep E pux ~ u 

Pes \ uezy 

Since / is a univariate polynomial in Xi, nonzero terms in the purely positive 
part (fS e )+ can only come from terms in S e where the monomial X u contains no 
variable other than Xi. (Any other terms in the product are "mixed" and project 
to zero.) As a result 



Pes \ j>o 

= (/!> x 




,, sf X t - Xi (P) 



+ 



= X i ^e P J] (Xi-MQ))- 

Pes QeS,Q^P 

The polynomial g appears on the right of the final line here, and the other claims 
now follow from the usual analysis in the univariate case or (3.4). □ 

The same reasoning shows that in case £ is not in general position with respect 
to Xi and / is the generator for Ig n F g [Xj], then we still have (fS)+ = Xig for 
g G Fq[Xj], but now for each root a of f(Xi) = 0, 

J V ' PeS,Xi(P)=a 

Even when £ is not in general position with respect to any of the variables, the 
error values ep can be recovered from S e and the univariate polynomials fi(Xi), 
i = 1, . . . , s generating the collection of elimination ideals IsC\¥ q [Xi]. We illustrate 
the idea in a simple example with s = 2 before giving the general statement. 

(5.2) Example. Let 



£ = {Pi, . . . , P 4 } = {(0, 0), (0, 1), (1, 1), (a, 1)} 
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in A 2 over W q , where a ^ 0, 1. Note that £ is not in general position with respect 
to either X or Y. We have univariates fi(X) = X(X — 1)(X — a) and f2(Y) = 
Y(Y — 1). Using (3.3), (4.4), and computations as in Example (4.6), we have 

Y XY XY 

S e = e Pl + ep 2 — — - + ep 3 — — — — — — + ep 4 



Y-l ^ 3 (X-1)(Y-1) ^ 4 (X-a)(Y-l)' 

(Note the special form of hp when one coordinate is zero.) Hence 

(hf 2 S) + = XY(e Pl (X - 1)(X - a)(Y - 1) + e P2 (X -1)(X- a)Y 
ep 3 X(X -a)Y + ep 4 X(X -1)Y). 

Write g(X, Y) for the factor in the parentheses on the right. Note that if we 
substitute the points of £ in to g, only one term is nonzero each time, and this 
allows us to determine the epr. 

giPt) = <7(0,0) = -ae Pl 
g(P 2 ) = g(0, 1) = ae P2 
g(P 3 )=g(lA) = (l-a)ep 3 
g(P 4 ) = g(a, 1) = a(a - l)ep 4 , 

because the factor multiplying ep i is the product 

(5-4) J] (X(Pi)-l) II (Y(P i )-8)^0. 

{7:/i(7)=0, 7 /X(P0} {S:f 2 (S)=0,S^Y(P,)} 

There is another useful expression for (5.4). This product is the same as 

/j(x(p 4 ))/S(y(Pi)). 

Note also that if we divide the term multiplying ep i in g(X, Y) by (5.4) we get one 
of the polynomials in a multivariable Lagrange interpolation basis for F g [X, Y]/Is, 
that is a collection of polynomials satisfying gi(Pk) = if k ^ i, and gi(Pk) = 1 if 
k = i. The same is true in general as we will now show. 

(5.5) Proposition. Let £ = {Pi, . . . , P t } be a finite set in A s over ¥ q . Let fa be 
the monic generator of Is fl F g [Xj], % = 1, . . . , s. Then 



(fif2---fsh Pi ) + = (Y[X i )g i , 



i=i 

where the polynomials gi satisfy 
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and gi(Pk) = ifk ^ i. As a result, the gi(X) / 'gi(Pi) form a Lagrange interpolation 
basis for ¥ q [Xi,... , X s ] / 1 £ . 

Proof. This follows immediately from part (4) of (3.3) and (3.4). □ 
From (5.5) we have 



and this allows us to determine the error values. 

We close this section with a comment about the problem of determining the 
univariate error locator polynomials This can be done easily given any Grobner 
basis Q of Is (for instance the output of the BMS algorithm), using the linear algebra 
techniques in F g [Xi, . . . ,X s ]/l£ described, for instance, in [CLO], Chapter 2, Sec- 
tion 2. Using normal form calculations with respect to Q, to determine /j, we would 
simply determine the smallest k for which the normal forms of l,Xi,Xf, . . . ,Xj? 
give a linearly dependent set in F q [Xi, . . . , X s ]/Ig. The corresponding dependence 
equation gives the univariate polynomial /j. Computations of this type would also 
be used, for instance, to convert the Grobner basis Q to a lexicographic Grobner 
basis via the FGLM algorithm to solve for the error locations by elimination. 

§6. Two Examples 

In this section we will present two examples illustrating the results of the previous 
sections. 

(6.1) Example. For our first example, we consider Hermitian codes, in particular 
codes constructed from the order domain R = ¥iq[X, Y]/ (X 5 + Y A + Y), the affine 
coordinate ring of the Hermitian curve over Fi6- In the set-up from §2, we have 
r = 1, p{X) = 4, p{Y) = 5, and V = (4,5) C Z> . Taking the >(4 ) 5),z ex monomial 
order the monomials in A = {A^y j : < i < 4, j > 0} are an Fi 6 -basis for R. As 
is well-known, there are 64 affine Fig-rational points on the Hermitian curve Xr. 

By the Feng-Rao bound, the minimum distance of the C21 = ev(V2i)~ L code is 
at least 15, so we expect to be able to correct any 7 errors in a received word. In 
the order defined previously, 




where g = £)| =1 ep.tfc. Hence g(Pi) 



ePigi(Pi), so by (5.5), 



(5.6) 



g{Pi) 



V21 = Span{l,X,Y,X 2 ,... ,Y 5 }. 
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Hence all syndromes £(i,j) with % + j < 4 and 

#(4,1), #(3,2), £( 2 ,3), #(1,4), #(0,5) 

are known initially from the received word. In addition, using the equation of the 
curve, we determine £ (5)0) = £ (0 , 4 ) + #(o,i)» and E (6,o) = E (i,4) + E (i,i)- 

To normalize the field, we take Fi 6 = ¥ 2 [f3]/(f3 4 + [3 + 1), so /3 is a primitive 
element. We consider the error of weight 7 for which 

5 = m P% (/3 2 , /3 M ), (P\ /3 6 ), (/3 5 , /3 M ), (/3 8 , (3% (P 11 , P 12 ), (0, 0)} 
and the corresponding error values are 

p,p 4 ,p 12 ,l,l,p,p. 

As is usual for these codes, the known syndromes do not suffice to determine 
the error locations and values. Running the BMS algorithm with Feng-Rao major- 
ity voting, additional syndromes £( 4 , 2 ), £(3,3), £(2,4) are computed, and the curve 
equation furnishes the values of £(6,1) and £(7,0)- The output of the BMS algorithm 
is the following Grobner basis for Ig\ 

pi = X 2 Y + ((3 s + (3 2 + (3)X + ((3 2 + (3)Y + ((3 + 1)XY + ((3 3 + (3 2 )Y 2 

+ ([3 3 + [3 2 + l)X 3 , 
p 2 = XY 2 + {(3 2 + 1 + (3)Y + ((3 3 +(3 2 + (3)Y + {(3 2 + 1)X 2 

(6.2) + {(3 3 + (3)XY + {(3 2 + 1 + (3)Y 2 + {(3 3 + (3 2 + (3)X 3 , 
p 3 = Y 3 + ((3 3 + (3 + 1)X + {(3 2 + (3)Y + (3 2 X 2 + (3 3 XY 

+ (/3 3 + f3 2 + /3)Y 2 + (f3 3 +/3 2 + 1)X 3 , 
p 4 = X 4 + (13 + 1)XY + (I3 3 + f3 2 )X 3 + /3 2 X 2 + f3 3 Y 2 + f3 2 Y. 

The leading terms are written first in each case, so the "footprint" of the ideal Is 
(the set of monomials in the complement of LT>(/£)) is 

A £ = {i,x,y,i 2 ,iF,r 2 ,i 3 }, 

and consists of the first 7 monomials in Fi6[X, Y] in the >(4,5) ) z ex order. This is 
the "generic" case for errors of weight exactly 7 with this ordering. 

At this point if we write the polynomials in (6.2) as / = n X m Y n , then all 
solve a system of equations of the form in (4.4): 

(6.3) / min £( m+r)n+s ) = 

m,n 

for all 

(r, s) E {(0, 0), (1, 0), (0, 1), (2, 0), (1, 1), (0, 2), (3, 0)}. 
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Hence they are solutions of the truncated key equation 
(6.4) / • S e = mod W 

where W = Span{X- a Y~ b : (a, b) >(4, 5)jlex (3, 0)}. The polynomials in (6.2) could 
also be found of course by directly solving the linear equations (6.3). If W in (6.4) 
is replaced by any W' C W, the set of solutions will be the same. 

To determine the error values in a systematic way, we could now exhaustively 
search for solutions of the system p\ = ■ ■ ■ = p4 = 0, or proceed as follows: 

(1) Convert the Grobner basis {pi,P2,P3,P4:} to a lex Grobner basis using the 
FGLM algorithm. (If we made X the smallest variable we would note that 
S is in general position with respect to X as in §5; with Y as the smallest 
variable, we would see that £ is not in general position with respect to Y.) 

(2) Solve the corresponding system to find the points in S. 

(3) Form any other needed univariate polynomials in Ig from the solutions. 

Then (5.1) with the univariate polynomial in X , or (5.6) will recover the error 
values. 

One of the important things to realize about the results in this article is that 
even though this first example was constructed using a code from an order domain 
with r = 1 (a well-studied example of a geometric Goppa code from a curve), the 
actual process of applying the BMS algorithm and determining the error values 
would be exactly the same for any other example of a Ce code. This is the real 
lesson of [HS] (although the real power of that approach was probably not noticed 
at the time because order domains of arbitrary transcendence degree had not been 
used to construct codes as of yet). At the fundamental level, we are always working 
with the ideal Is of a finite set of points in A s , and the determination of error 
locations and values can be performed in a totally uniform fashion. 

For example, here is the same sort of computation for a two-dimensional extended 
cyclic code. (This is the dual of the extended code corresponding to one of Hansen's 
toric codes, see [H].) 

(6.4) Example. Let ¥s = F2[a]/(a 3 + a + l), and consider order domain structure 
on R = ¥g[X, Y] induced by the graded lexicographic order with X > Y. We have 

V 10 = Span{l, Y, X, Y 2 ,XY, X 2 , Y 3 ,XY 2 , X 2 Y, X 3 } 

and these give the known syndromes for Cio = Ev i (where the evaluation code is 
formed using all 64 F 8 rational points in A 2 ). By the Feng- Rao theorem, this code 
has d > 5, so we consider an error vector with £ = {P, Q} = {(1, 1), (a, a 2 )} and 
e P = l,eg = a 2 + 1. 

In this case the known syndromes are sufficient to determine a Grobner basis for 
Is by BMS; we are in effect solving the truncated key equation 

/ • 51 = mod W, 
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where «S e is the known part of the syndrome series, and W = Span{X m Y n : 
m + n > 2}. The output is 

{x + (a 2 + a)y + a 2 + a + 1, y 2 + (a 2 + a)y + a 2 } 

which is the graded lex Grobner basis for Ig . The error values are determined using 
(5.1) or (5.6). 
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